X2Go Bug report logs - #293
Use initgroups() to initialize group access list

version graph

Package: nx-libs; Maintainer for nx-libs is X2Go Developers <x2go-dev@lists.x2go.org>;

Reported by: Orion Poplawski <orion@cora.nwra.com>

Date: Thu, 29 Aug 2013 17:18:02 UTC

Severity: normal

Tags: patch, pending

Fixed in version 2:3.5.0.21

Done: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Bug is archived. No further changes may be made.

Full log


Message #10 received at 293@bugs.x2go.org (full text, mbox, reply):

Received: (at 293) by bugs.x2go.org; 29 Aug 2013 20:24:41 +0000
From x2go@ymir  Thu Aug 29 22:24:33 2013
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_RELAYS,
	URIBL_BLOCKED autolearn=unavailable version=3.3.2
Received: by ymir (Postfix, from userid 1005)
	id 25D0A5DB20; Thu, 29 Aug 2013 22:24:33 +0200 (CEST)
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: 293-submitter@bugs.x2go.org
Cc: control@bugs.x2go.org, 293@bugs.x2go.org
Subject: X2Go issue (in src:nx-libs) has been marked as pending for release
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Mailer: http://snipr.com/post-receive-tag-pending
Message-Id: <20130829202433.25D0A5DB20@ymir>
Date: Thu, 29 Aug 2013 22:24:33 +0200 (CEST)
tag #293 pending
fixed #293 2:3.5.0.21
thanks

Hello,

X2Go issue #293 (src:nx-libs) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=0946b43

The issue will most likely be fixed in src:nx-libs (2:3.5.0.21).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit 0946b437570dea31365790d5cbf39c39f1b59c02
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Thu Aug 29 22:24:26 2013 +0200

    Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid without setgroups or initgroups. There is a high probability this means it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. (Fixes: #293).

diff --git a/debian/changelog b/debian/changelog
index 2242a75..b523ee1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -19,6 +19,11 @@ nx-libs (2:3.5.0.21-0) UNRELEASED; urgency=low
   * Change build options so that bundled libraries are not used anymore at
     build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
     #238).
+  * Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
+    without setgroups or initgroups. There is a high probability this means it
+    didn't relinquish all groups, and this would be a potential security issue
+    to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
+    #293).
 
  -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Thu, 28 Mar 2013 21:07:42 +0100
 


Send a report that this bug log contains spam.


X2Go Developers <owner@bugs.x2go.org>. Last modified: Thu Mar 28 12:21:57 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.